View as a webpage / Share

Volume 24 — Issue 28 | July 11, 2024

Using standards when selecting and purchasing responder equipment

The Department of Homeland Security (DHS) Science and Technology Directorate (S&T) just released a report for emergency response agencies, Guidance for Using Standards When Selecting and Purchasing Responder Equipment.

While there are many standards for responder equipment, there is not a requirement for all products to meet those standards before being offered for sale in the marketplace. Therefore, standards are relevant when purchasing protective or operational equipment that a responder will use in the field.

This report provides guidance related to the use of standards when selecting and purchasing protective and operational equipment for public safety organizations, including law enforcement agencies, fire departments, and emergency medical service (EMS) agencies. The document explains what standards are, why they are relevant, and how to take advantage of their use in procuring equipment. The report’s appendix provides an overview of available federal grant programs that offer funding for responder equipment that conforms to standards. A table lays out several types of responder equipment, applicable standards, and associated verification or certification programs.

This report was prepared by DHS S&T’s National Urban Security Technology Laboratory (NUSTL), in collaboration with the National Institute of Standards and Technology (NIST), as part of NUSTL’s System Assessment and Validation for Emergency Responders (SAVER) program.

Access the report within the DHS Publications Library.

(Source: DHS S&T)

Highlights

Using standards when selecting and purchasing responder equipment

FCC releases report on 2023 nationwide emergency alert test

EMS for Children Program updates Pediatric Interfacility Transfer Guide

Webinar: Introduction to FEMA’s community preparedness workshop on integrating the needs of children in disaster planning

Cyber Threats

The U.S. Fire Administration operates the Emergency Management and Response – Information Sharing and Analysis Center (EMR-ISAC).

For information regarding the EMR-ISAC visit www.usfa.dhs.gov/emr-isac or contact the EMR-ISAC office at: (301) 447-1325 and/or fema-emr-isac@fema.dhs.gov.

FCC releases report on 2023 nationwide emergency alert test

On October 4, 2023, the Federal Emergency Management Agency (FEMA) and the Federal Communications Commission (FCC) conducted its most recent nationwide tests of Wireless Emergency Alerts (WEA) and the Emergency Alert System (EAS).

On June 27, 2024, the FCC’s Public Safety and Homeland Security Bureau (PSHSB) released a report analyzing how the EAS and WEA performed during the test.

EAS Test Results

When compared with the last EAS test in 2021, there was noticeable improvement in 2023. This was reflected in the number of test message receipts (96.6% in 2023 versus 89.3% in 2021) and retransmissions (93.6%, up from 87.1% in 2021).

The 2021 EAS test only used over-the-air distribution. However, the 2023 EAS test was sent out using both the traditional broadcast-based distribution structure and using FEMA’s Integrated Public Alert & Warning System (IPAWS). IPAWS uses a Common Alerting Protocol (CAP) over multiple communication pathways. The FCC attributes this improvement in 2023 to the fact that CAP messaging was used.

The 2023 test showed that EAS is far less reliable in U.S. territories. Five of the six poorest-performing geographic regions were the Northern Mariana Islands (20.0% retransmission success), Guam (33.3%), American Samoa (66.7%), the U.S. Virgin Islands (88.9%) and Puerto Rico (89.7%). This is troubling since these territories have been plagued by multiple tropical storms and typhoons in recent years, making emergency alerts vital for public safety.

Outdated equipment was a significant issue. Equipment with outdated software accounted for 30% of reported issues receiving the message and 20% of reported issues retransmitting the message.

PSHSB recommended engagement with U.S. territories and adoption of rules to improve the operational readiness of EAS Participants, particularly to address outdated equipment.

WEA Test Results

Based on stakeholders’ survey data shared with the FCC, most respondents reported successful receipt of the WEA test message.

While the last WEA test in 2022 was sent as a system test message that mobile device users had to opt in to receive, the 2023 WEA test was sent as a National Alert, which subscribers cannot opt out of receiving. Therefore, the 2023 WEA test message was sent to all consumer cellphones in the United States and its territories.

Although the WEA test was largely successful, it highlighted areas for improvement.

The New York City Emergency Management Department (NYCEM) surveyed 1.18 million subscribers via its Notify NYC program about the WEA test. There were 1,405 responses to NYCEM’s survey and 5.8% of respondents reported they did not receive the WEA test message.

Some Participating Commercial Mobile Service (CMS) Providers reported that they experienced technical failures during the test that prevented members of the public from receiving the alert, such as failure of alert message audio tone and/or vibration on mobile devices.  There were also a few issues with displaying the appropriate language on mobile devices.

The FCC is recommending that Congress require all CMS Providers to support WEA, which is currently only voluntary. The PSHSB is also recommending that the FCC adopt rules to improve the operational readiness and software updating practices of Participating CMS Providers.

Access the report at FCC.gov for additional technical details and recommendations.

(Source: FCC)

EMS for Children Program updates Pediatric Interfacility Transfer Guide

The Emergency Medical Services for Children (EMSC) Innovation & Improvement Center (EIIC) has just released an updated Pediatric Interfacility Transfer Guide, in collaboration with the Emergency Nurses Association and Society of Trauma Nurses. The EIIC is supported by funding from the Health Resources and Services Administration (HRSA) of the U.S. Department of Health and Human Services (HHS).

This guide and its related online toolkit have been designed to facilitate the development of a systematic, timely transfer process for pediatric patients. The information included is applicable to all patients requiring transfer to access specialty care.

The guide is divided into 11 sections. Each section provides guidance on an aspect of the transfer process, including information on planning, preparing for, and executing the transfer. The guide includes steps for drafting agreements, agreement examples, regulatory resources, case studies and more.

The user might find all sections helpful or might prefer to focus on certain sections based on where the institution is in its interfacility transfer process. Additional resources, organized by section, are available in a companion toolkit online.

(Source: EIIC)

Webinar: Introduction to FEMA’s community preparedness workshop on integrating the needs of children in disaster planning

Communities need to have an emergency management program in place that prioritizes the safety of children. Children cannot be an afterthought during a disaster; the stakes are too high and the needs, regulations, and equipment too specific to "figure it out" in the middle of a crisis.

To help with deliberate planning for children, FEMA's Community Preparedness: Integrating the Needs of Children workshop encourages collaboration between local governments, emergency management professionals, and a diverse array of community-based organizations that serve children.

FEMA's “Community Preparedness: Integrating the Needs of Children” workshop is a free resource designed to bring emergency managers, medical professionals, childcare providers and other partners together to boost community resilience. It walks participants through identifying the organizations, requirements and resources needed in their preparedness programs to ensure that children are kept safe and healthy during disasters.

There are seven lesson-based modules, as well as a wrap-up module. To accommodate the wide range of schedule challenges, the course has several delivery options that account for full-day, two-day, and three-day courses, as well as virtual facilitation instructions.

FEMA is hosting an informational webinar on Wednesday, July 17, at 1 p.m. EDT, to formally launch the workshop. The webinar will provide a detailed overview of the workshop, including the goals and target audience, workshop topics and structure, and details on how it can be customized to fit the audience’s needs.

Register for the July 17 webinar on Zoom. Learn more about the workshop and access course materials at FEMA.gov.

(Source: FEMA)

Cyber Incident Assistance

MS-ISAC
SOC@cisecurity.org
1-866-787-4722

IdentityTheft.gov

IC3

Cybercrime Support Network

General Information

StopRansomware.gov

CISA's Known Exploited Vulnerabilities Catalog

FTC scam list

CISA alerts

Law Enforcement Cyber Center

TLP Information

CISA and FBI release Secure by Design Alert on Eliminating OS Command Injection Vulnerabilities

On July 10, the Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) released the newest Secure by Design Alert in the series, Eliminating OS Command Injection Vulnerabilities, in response to recent well-publicized threat actor campaigns that exploited OS command injection defects in network edge devices (CVE-2024-20399, CVE-2024-3400, CVE-2024-21887) to target and compromise users. These vulnerabilities allowed unauthenticated malicious actors to remotely execute code on network edge devices.

OS command injection vulnerabilities have long been preventable by clearly separating user input from the contents of a command. Despite this finding, OS command injection vulnerabilities—many of which result from CWE-78—are still a prevalent class of vulnerability.

(Source: CISA)

CISA and partners join ASD’S ACSC to release advisory on PRC state-sponsored group, APT 40

CISA has collaborated with the Australian Signals Directorate’s Australian Cyber Security Centre (ASD's ACSC) to release an advisory, People’s Republic of China (PRC) Ministry of State Security APT40 Tradecraft in Action outlining a PRC state-sponsored cyber group’s activity.

The advisory is based on current ACSC-led incident response investigations and shared understanding of a PRC state-sponsored cyber group, APT40—also known as Kryptonite Panda, GINGHAM TYPHOON, Leviathan and Bronze Mohawk in industry reporting.

APT 40 has previously targeted organizations in various countries, including Australia and the United States. Notably, APT 40 possesses the ability to quickly transform and adapt vulnerability proofs of concept (POCs) for targeting, reconnaissance, and exploitation operations. APT 40 identifies new exploits within widely used public software such as Log4J, Atlassian Confluence and Microsoft Exchange to target the infrastructure of the associated vulnerability.

CISA urges all organizations and software manufacturers to review the advisory to help identify, prevent, and remediate APT 40 intrusions.

(Source: CISA)

FBI: State-sponsored Russian media leverages Meliorator software for foreign malign influence activity

The FBI and Cyber National Mission Force (CNMF), in partnership with the Netherlands General Intelligence and Security Service (AIVD), Netherlands Military Intelligence and Security Service (MIVD), the Netherlands Police (DNP), and the Canadian Centre for Cyber Security (CCCS), (hereinafter referred to as the authoring organizations) are releasing this advisory to warn social media companies that Russian state-sponsored actors have leveraged the covert Meliorator software for foreign malign influence activity benefiting the Russian Government.

Affiliates of RT (formerly Russia Today), a Russian state-sponsored media organization, used Meliorator—a covert artificial intelligence (AI) enhanced software package—to create fictitious online personas, representing a number of nationalities, to post content on X (formerly Twitter). Using this tool, RT affiliates disseminated disinformation to and about a number of countries, including the United States, Poland, Germany, the Netherlands, Spain, Ukraine, and Israel.

Read the full joint cybersecurity advisory on the FBI’s Internet Crime Complaint Center (IC3) for technical details and mitigations.

(Source: FBI IC3)

NSA’s final zero trust pillar report outlines how to achieve faster threat response time

The National Security Agency (NSA) is releasing the Cybersecurity Information Sheet (CSI) Advancing Zero Trust Maturity Throughout the Automation and Orchestration Pillar to help organizations better detect cyber threats and respond to common threats faster.

This report – the final CSI published by NSA in a series addressing the seven pillars of DoD’s Zero Trust (ZT) framework – also provides recommendations for automating routine tasks to better focus resources on investigating anomalies associated with advanced tactics, techniques, and procedures.

(Source: NSA)

CISA Live! – Cybersecurity for Healthcare and Public Health, July 17

CISA has dedicated its July 17 CISA Live! to the healthcare and public health sector. Hosted on LinkedIn, this event offers participants an opportunity to learn about current cybersecurity threats to the sector, including nation-state actors and ransomware, as well as the tools and resources CISA and the Department of Health and Human Services (HHS) provide to help the sector prevent, mitigate, and recover from cyber incidents. Bring your questions, since event attendees can also participate in a live question and answer session.

Visit the event page on LinkedIn on Wednesday, July 17 at 11:30 a.m. EDT to join. A free LinkedIn account is required to join. Visit the CISA Live! webpage to see previous episodes and announcements for upcoming events. Visit the CISA Live! playlist on CISA’s YouTube channel to watch recordings of past events.

(Source: CISA)

Tribal governments receive first-ever cyber grants

Since the passage of the bipartisan infrastructure law in 2021, states have received hundreds of millions of dollars in grant funding for cybersecurity, out of a pot of $1 billion to be distributed over four years. Now, for the first time, tribal governments are getting a piece of that pie.

In a joint announcement last week, DHS, FEMA, and CISA, said they awarded $18.2 million under the Tribal Cybersecurity Grant Program to 32 tribal nations. It is the largest number of awards the federal government has provided under a single grant program to tribal governments, according to DHS.

All grant recipients will be required to take part in two free CISA services: a nationwide cybersecurity review and cyber hygiene vulnerability scanning. The former service is an anonymous yearly self-assessment designed to measure a recipient’s cybersecurity programs’ gaps and capabilities. The latter evaluates a tribe’s external network presence through continuous scanning for vulnerabilities.

(Source: Route Fifty)

Ransomware hits CDK Global, public sector targets in June

While one of June's most significant ransomware attacks occurred against software vendor CDK Global, the threat also heavily affected local governments and brought public services to a standstill.

Traverse City, Mich., disclosed that it suffered a ransomware attack on June 12 that affected city government operations as well as public offices in Grand Traverse County. On June 25, The Ticker reported that Traverse City commissioners voted to update the city's insurance policy in response to the attack. BlackSuit claimed responsibility for the attack during communications with the city.

Cleveland City Hall disclosed that the city suffered a cybersecurity incident on June 10 that forced it to shut down affected systems and close City Hall for nearly two weeks. Cleveland residents could not submit payments, permits, or building or housing applications. In an update on June 18, the city said some operations would resume on June 20.

The BlackByte ransomware group claimed responsibility for a June 10 attack against the City of Newburgh, N.Y. On June 14, the city disclosed the incident and said it affected some public services, such as payments for property taxes, water, sewer, sanitation and parking. There were also "minor disruptions" to the police, fire, water, engineering and recreation department operations.

(Source: TechTarget)

The InfoGram is distributed weekly to provide members of the Emergency Services Sector with information concerning the protection of their critical infrastructures.

Fair Use Notice:
This InfoGram may contain copyrighted material that was not specifically authorized by the copyright owner. The EMR-ISAC believes this constitutes “fair use” of copyrighted material as provided for in section 107 of the U.S. Copyright Law. If you wish to use copyrighted material contained within this document for your own purposes that go beyond “fair use,” you must obtain permission from the copyright owner.

Linking Policy and Disclaimer of Endorsement:
The appearance of external hyperlinks does not constitute endorsement of the linked websites, or the information, products or services contained therein. We provide these links and pointers solely for your information and convenience. When you select a link to an outside website, remember that you are subject to the privacy and security policies of the owners/sponsors of the outside website. To view information and resources on the policies that govern FEMA web content visit FEMA Website Information.

Section 504 Notice:
Section 504 of the Rehabilitation Act requires that FEMA grantees provide access to information for people with disabilities. If you need assistance accessing information or have any concerns about access, please contact FEMAWebTeam@fema.dhs.gov.